AML / Financial Crime

What Changed

• (Strictly speaking this is an enforcement case rather than a rule change, but it effectively clarifies regulatory expectations and evidences enforcement priorities.)
• Licensed corporations must treat discrepancies between a client’s declared financial profile and purported asset holdings as material red flags, triggering enhanced KYC,...
• Firms must independently verify documents purportedly issued by other brokers, especially when used as proof of holdings for sell orders, and must not rely on such documents at face value when they...
• Licensed corporations are expected to apply risk-based AML/CFT controls to securities sell orders where there is a risk that the client may not beneficially own the assets, or where forged/false...
• Firms must report suspected fraudulent or deceptive conduct by clients to the SFC (and, where applicable, to JFIU) without delay, even where the misconduct appears confined to a single transaction or...

Suggested Considerations

• Review and update client onboarding procedures to ensure that inconsistencies between clients’ declared financial profiles and claimed asset holdings are systematically identified, documented, and escalated for enhanced due diligence before any orders are executed.
• Implement controls requiring independent verification (e.g. direct confirmation or reliable third‑party checks) of statements and documents purportedly issued by other brokers when these are used to evidence holdings for sell orders.
• Update AML/CFT policies and procedures under AMLO and the SFC Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations) to explicitly cover handling of suspected forged documents and false information supplied by clients.
• Establish or reinforce a formal process for promptly reporting suspected fraudulent, deceptive, or market abusive conduct by clients to the SFC, and where appropriate to JFIU, including clear internal thresholds, escalation paths, and record‑keeping.
• Conduct a gap analysis of existing red flag indicators to ensure they cover situations where the size or nature of client holdings is incommensurate with the client’s stated income, net worth, occupation, or overall risk profile.

Key Dates

References

• [1] webb-site.com/codocs/SFC060328.pdf
• [2] kucoin.com/news/flash/hong-kong-sfc-fines-victory-securit...
• [3] sfc.hk/en/Regulatory-functions/Enforcement/Disciplinary-p...
• [4] www1.hkexnews.hk/listedco/listconews/gem/2018/0716/gln201...
• [5] sfc.hk/-/media/EN/files/COM/QR-Reports/202110-12/2eEnforc...
• [6] chinadailyhk.com/hk/article/353041
• [7] sfc.hk/-/media/EN/files/COM/Reports/Enforcement-Reporter_...

What Changed

• - The AMF’s decision reinforces that asset managers must maintain continuous compliance with their authorisation conditions, but isolated overreach by a person not listed as an executive officer was...
• Firms must have procedures that identify and manage conflicts of interest, including conflicts arising from links with a parent company and from the overlapping functions of directors and financial...
• Asset managers must ensure continuity of human resources and align remuneration practices for financial managers with the applicable regulations, the approved programme of activity, and internal...
• Firms must disclose to investors management-fee retrocessions paid to distributors and must be able to justify any claimed enhancement of the service provided.
• Information provided to investors and prospects must be clear, accurate, and not misleading, including in marketing materials.

Suggested Considerations

• Review the firm’s authorisation file, governance map, and executive-officer appointments to confirm that actual decision-making powers match the AMF-approved organisational structure.
• Update conflicts-of-interest procedures to capture conflicts arising from parent-company relationships, cross-directorships, and shared finance leadership roles.
• Test whether staffing levels and succession arrangements ensure continuity of human resources for control functions and key operational roles.
• Reassess remuneration arrangements for financial managers to verify consistency with the firm’s programme of activity, internal procedures, and regulatory requirements.
• Verify that all distributor retrocessions are fully disclosed to investors and that any claim of enhanced service is documented with evidence.

Key Dates

References

• [1] amf-france.org/en/news-publications/news-releases/enforce...
• [2] amf-france.org/sites/institutionnel/files/pdf/77659/en/Th...
• [3] finascope.fr/english/reglementation/la-commission-des-san...
• [4] kroll.com/en/publications/financial-compliance-regulation...
• [5] kroll.com/en/insights/publications/financial-compliance-r...
• [6] amf-france.org/en/news-publications/news-releases/enforce...
• [7] opalesque.com/712766/AMF_ruling_underscores_personal_acco...
• [8] navacelle.law/historical-sanctions-financial-markets-auth...

What Changed

• - The Central Bank of Ireland has formally identified “Bates Finance Limited (CLONE)” as an unauthorised investment firm / investment business firm and published its details (name, website, email,...
• The warning explicitly states that Bates Finance Limited (CLONE) is not authorised to provide investment services in Ireland and is cloning an authorised firm’s details to pass itself off as...
• The Central Bank confirms that there is no connection between the legitimate authorised firm and the cloned entity using its name.
• The firm’s name is published under section 53 of the Central Bank (Supervision and Enforcement) Act 2013, reaffirming the Central Bank’s enforcement power to publicly name unauthorised providers.
• The warning reiterates channels for reporting suspected unauthorised firms to the Central Bank (telephone and online reporting), reinforcing expectations that firms and individuals will escalate...

Suggested Considerations

• Monitor the Central Bank of Ireland’s unauthorised firms and warning notices on an ongoing basis and promptly update internal watchlists, sanctions‑style lists, and fraud‑monitoring tools to include Bates Finance Limited (CLONE).
• Update customer‑facing communications, scam warnings, and investor education materials to reference clone firms and instruct clients to verify authorisation using the Central Bank’s Registers before engaging with any investment firm.
• Review and strengthen controls for detecting and responding to clone firm activity, including monitoring for misuse of the firm’s name, logo, Companies Registration Office number, or website domain in Ireland and other jurisdictions.
• Implement procedures to immediately escalate to the Central Bank and law enforcement (e.g. An Garda Síochána) if the firm becomes aware that its identity is being cloned or if clients are approached by Bates Finance Limited (CLONE) or similar unauthorised entities.
• Enhance due‑diligence and onboarding checks to validate counterparties and intermediaries offering investment products into Ireland, ensuring they hold appropriate authorisation from the Central Bank or relevant EU/EEA regulators.

Key Dates

References

• [1] centralbank.ie/regulation/how-we-regulate/authorisation/u...
• [2] centralbank.ie/regulation/how-we-regulate/authorisation/u...
• [3] centralbank.ie/news/article/warning-notice-service-financ...
• [4] service.betterregulation.com/document/30388
• [5] registers.centralbank.ie/downloadspage.aspx
• [6] fca.org.uk/news/warnings/bates-finance-clone-uk-registere...
• [7] eu-fpg.com/resources/jurisdictions/ireland
• [8] centralbank.ie/news/article/warning-notice-central-bank-o...

What Changed

• - The Central Bank of Ireland has formally designated “Russell Administration Limited (CLONE)” as an unauthorised investment firm under section 53 of the Central Bank (Supervision and Enforcement)...
• The warning confirms that Russell Administration Limited (CLONE) is not authorised to provide investment services in Ireland, and that there is no connection between this clone entity and the...
• The Central Bank has publicly disclosed specific identifiers for the unauthorised firm (website, email address, and phone number) to assist firms and consumers in recognising and blocking fraudulent...
• The notice reiterates that firms and individuals can report suspected unauthorised or clone firms directly to the Central Bank via designated telephone contact points.
• By publishing the warning, the Central Bank reinforces its policy that operating as an investment firm in Ireland without appropriate authorisation is unlawful and subject to supervisory and...

Suggested Considerations

• Verify that your firm’s name, contact details, and regulatory authorisation information have not been cloned or misused by Russell Administration Limited (CLONE) or other similar entities, and escalate any evidence of impersonation to the Central Bank and local law enforcement.
• Update client-facing communications, including website fraud alerts and investor letters, to warn about clone firms and specifically list known identifiers (such as the Russell Administration Limited (CLONE) website, email address, and phone number) where relevant to your client base.
• Instruct front-office, call centre, and relationship management staff to advise clients to check the Central Bank Registers and unauthorised firms list before engaging with any entity claiming to be regulated in Ireland, and to report any suspicious contact immediately.
• Review and strengthen internal financial crime and fraud detection controls to include explicit screening for clone firm indicators, such as mismatched contact details, unregistered domains, and requests to transfer funds to newly introduced counterparties.
• Incorporate the Russell Administration Limited (CLONE) warning and similar Central Bank warning notices into your firm’s ongoing financial crime risk assessments and customer risk profiling, particularly for high-risk investment products and cross-border services.

Key Dates

References

• [1] centralbank.ie/regulation/how-we-regulate/authorisation/u...
• [2] service.betterregulation.com/document/30388
• [3] centralbank.ie/regulation/industry-market-sectors/securit...
• [4] fi.ee/sites/default/files/2025-08/Loan%20365%20(Clone)%20...
• [5] linkedin.com/posts/central-bank-of-ireland_central-bank-o...
• [6] registers.centralbank.ie
• [7] edit.centralbank.ie/docs/default-source/publications/fina...

What Changed

• - The CSSF demonstrates that it is prepared to impose administrative sanctions directly on members of the board of directors of electronic money institutions, not just on the institution as a legal...
• Board members of Luxembourg‑authorised electronic money institutions are now clearly exposed to personal regulatory liability for governance, risk management and safeguarding failures under the CSSF...
• This enforcement confirms that CSSF Circular 26/906 on central administration, internal governance and risk management for payment institutions and electronic money institutions is not only a formal...
• The sanction underscores CSSF expectations that the supervisory body (board of directors) must ensure sound and prudent management, continuity of the institution and protection of its reputation, and...
• The case signals a stricter enforcement posture by the CSSF towards the payments and e‑money sector, aligning its expectations and enforcement intensity more closely with bank‑equivalent governance...

Suggested Considerations

• Review and map the institution’s current governance framework, board charter and committee mandates against the detailed requirements of CSSF Circular 26/906, including central administration, board composition, responsibilities and functioning.
• Ensure that the board of directors collectively has the required expertise, independence, diversity and time commitment, and that this is documented and periodically reassessed in line with CSSF expectations.
• Update board policies to explicitly assign responsibility for strategy, risk appetite, safeguarding of client funds, information security, outsourcing, conflicts of interest and AML/CFT, and ensure these responsibilities are effectively discharged and evidenced.
• Confirm that the institution’s central administration, decision‑making centre and administrative centre are physically located in Luxembourg and that members of the management body are sufficiently present on site, as required under the governance framework.
• Establish or reinforce the “three lines of defence” model by clearly separating business units, control functions (compliance and risk) and internal audit, and ensure reporting lines to the board are independent and robust.

Key Dates

References

• [1] klgates.com/Luxembourgs-CSSF-Circular-26/906-on-Central-A...
• [2] finconduit.com/resources/cssf-circular-26-906-emi-pi-gove...
• [3] loyensloeff.com/insights/news--events/news/circular-cssf-...
• [4] elvingerhoss.lu/insights/publications/circular-cssf-26906...
• [5] cssf.lu/en/2026/03/communication-to-the-investment-fund-i...
• [6] financialcrime.lu/2026/01/20/CSSF-Circular-26-906/

What Changed

• - The UN sanctions committee amended the list of sanctioned individuals, companies, and organizations relating to the Democratic Republic of Congo on 16 July 2026.
• The change is directly applicable in Switzerland, so firms cannot wait for a separate Swiss implementing act before acting on the updated list.
• SECO updated the Swiss sanctions database SESAM on 17 July 2026 and published the update on its website.
• Financial intermediaries must implement the prohibitions set out in the ordinance, including freezing the assets of sanctioned persons.
• Financial intermediaries must report the affected business relationships to SECO.

Suggested Considerations

• Review sanctions screening results immediately against the updated Congo-related list in SESAM and any internal watchlists to identify matching clients, counterparties, and beneficial owners.
• Freeze assets and block prohibited dealings involving newly designated persons, companies, or organizations as required by the ordinance.
• Report affected business relationships to SECO in line with the sanctions ordinance requirements.
• Perform enhanced internal clarifications under Article 6 GwG/AMLA whenever a sanctions hit or other red flags create suspicion.
• File an immediate suspicious activity report with the Money Laundering Reporting Office under Article 9 GwG/AMLA if doubts cannot be resolved.

Key Dates

References

• [1] finma.ch/de/news/2026/07/20260720-sr-946-231-12/
• [2] eda.admin.ch/en/newnsb/KbHRHJgit-lofkgs08y9Q
• [3] uvek.admin.ch/de/newnsb/KbHRHJgit-lofkgs08y9Q
• [4] admin.ch/fr/newnsb/KbHRHJgit-lofkgs08y9Q
• [5] un.org/german/de/media/16079
• [6] fiu.gov.ai/financial-and-targeted-sanctions/sanction-notices
• [7] gov.im/news/2026/jul/17/sanctions-lists-update-democratic...
• [8] ch.marketscreener.com/boerse-nachrichten/un-verhaengen-sa...

What Changed

• - The CBI has formally listed Aoncfd (CLONE) as an unauthorised investment firm / investment business firm that is not permitted to provide investment services or operate as an investment firm in...
• The CBI has publicly identified Aoncfd (CLONE)’s websites, email address, and purported Dublin address to support monitoring and blocking efforts by firms and market infrastructures.
• The CBI has clarified that Aoncfd (CLONE) is a clone entity that has copied the name, address and foreign registration details (CONSOB Registration 5141) of Aon Solutions Ireland Limited, and that...
• The publication reiterates that the CBI will use its section 53 naming power under the Central Bank (Supervision and Enforcement) Act 2013 to publicly warn about unauthorised firms.
• The notice reinforces existing expectations that firms, consumers, and intermediaries should use the CBI’s authorisations register and list of unauthorised firms as part of fraud and clone‑risk...

Suggested Considerations

• Firms should immediately screen client referral sources, onboarding records, and any existing or prospective relationships against the identifiers published for Aoncfd (CLONE) (names, URLs, email, and purported address) and block or terminate any exposure.
• Compliance teams should update internal fraud and financial crime watchlists and sanctions‑style screening tools to include Aoncfd (CLONE) and the specific URLs, email address and address cited in the warning.
• Authorised firms, particularly Aon Solutions Ireland Limited, should conduct brand‑misuse and impersonation checks (including web‑scraping, social media monitoring and domain surveillance) to identify further clone activity and prepare incident‑response plans.
• Client‑facing staff should be briefed via targeted compliance communications to warn clients about clone firms and to ensure they direct clients to the CBI’s register and unauthorised firms list when verifying any investment provider claiming an Irish authorisation.
• Firms should review and, where necessary, enhance KYC and onboarding controls to include explicit verification of a counterparty’s regulatory authorisation in Ireland (or relevant jurisdiction) and checks for inconsistencies between provided details and registry information.

Key Dates

References

• [1] centralbank.ie/news/article/fti-finance-limited-(clone)--...
• [2] fi.ee/sites/default/files/2023-02/CENTRA~2.PDF
• [3] finanstilsynet.no/contentassets/4bd8bb48debc4989af4e599b1...

What Changed

• - The CBI has formally listed “Codeve Insurance Co DAC (CLONE)” as an unauthorised insurance/reinsurance firm and insurance intermediary/distributor for Ireland.
• The CBI confirms that this entity is not authorised in Ireland to provide insurance, reinsurance or insurance distribution/intermediary services.
• The warning identifies specific contact points used by the clone: website `https://www.codeveinsurance.com` and email addresses `contact@codeveinsurance.com`, `legal@codeve.com` and...
• The CBI confirms that the unauthorised firm has cloned the name and details of the authorised firm CODEVE Insurance Company dac to pass itself off as that legitimate entity and deceive consumers.
• The CBI explicitly states there is no connection between the authorised CODEVE Insurance Company dac and the unauthorised clone, clarifying that the authorised firm is a victim of impersonation.

Suggested Considerations

• Update internal unauthorised/blacklist tables and watchlists to include “Codeve Insurance Co DAC (CLONE)”, the website `https://www.codeveinsurance.com`, and the email addresses `contact@codeveinsurance.com`, `legal@codeve.com`, and `Investorrelations@bournrockinvest.com`.
• Configure onboarding, third‑party due diligence and supplier management systems so that any counterparty or proposal referencing these identifiers or closely similar names triggers escalation and enhanced verification.
• Conduct an immediate screening of existing distribution, outsourcing, binder, reinsurance and fronting arrangements to confirm that no current relationships involve the clone entity or its contact details.
• Implement or reinforce a formal “clone‑firm check” in client and counterparty KYC/KYB procedures, requiring staff to verify authorisation status directly against the CBI’s registers and unauthorised firm list before entering into insurance or reinsurance arrangements linked to Ireland.
• Issue an internal compliance and financial‑crime alert to underwriting, sales, distribution, treasury and investment teams highlighting the Codeve clone, the specific identifiers, and the need to report any contact or proposals linked to this entity.

Key Dates

References

• [1] centralbank.ie/news/article/central-bank-of-ireland-issue...
• [2] centralbank.ie/docs/default-source/regulation/industry-ma...
• [3] fi.ee/sites/default/files/2026-01/Standard%20Life%20Irela...
• [4] williamfry.com/knowledge/cbi-publishes-consultation-paper...

What Changed

• - The Central Bank of Ireland has formally designated “MacKay Shields UK LLP (CLONE)” as an unauthorised investment firm / investment business firm / alternative investment fund manager and published...
• The notice clarifies that MacKay Shields UK LLP (CLONE) is not authorised to provide investment services, investment business services or AIFM services in Ireland and therefore any financial services...
• The Central Bank highlights that the clone firm has been offering fake investments via the applications NYLI and NYLIPLUS, emphasising a specific scam vector via investment apps rather than...
• The warning confirms that the clone firm has cloned the name and registration details of the legitimate MacKay Shields UK LLP (Central Bank register C121665), reinforcing the pattern of...
• The firm’s name is being published under section 53 of the Central Bank (Supervision and Enforcement) Act 2013, signalling that the Central Bank considers the activity sufficiently serious to warrant...

Suggested Considerations

• Review and update client‑facing communications, website content and FAQs to warn clients about clone‑firm risks, specifically referencing messaging‑app contact details and investment apps such as NYLI and NYLIPLUS that are not associated with authorised firms.
• Implement or enhance procedures within AML / financial crime and fraud‑risk frameworks to identify and escalate interactions involving the listed email address (support@mackay-shields.email) and the specified WhatsApp and telephone numbers, treating them as indicators of potential scam activity.
• Instruct front‑office, client‑relationship and call‑centre staff to verify authorisation status using the Central Bank’s public registers before acknowledging or forwarding any investment proposals that reference “MacKay Shields UK LLP” or similar branding.
• Notify internal legal and regulatory affairs teams, and where relevant the legitimate MacKay Shields UK LLP, of the clone warning to coordinate responses, client communications and potential reporting of any attempted impersonation or fraudulent use of the authorised firm’s details.
• Review existing third‑party distribution and referral arrangements to ensure counterparties are not using or promoting NYLI, NYLIPLUS or similar unregulated applications, and add contractual provisions requiring immediate notification if cloning or impersonation is suspected.

Key Dates

References

• [1] finanstilsynet.no/contentassets/1f99db27d4004b4198e3a44d1...
• [2] centralbank.ie/news/article/larl-f.s.---larl-financial-se...
• [3] centralbank.ie/news/article/apel-investments-(clone)---ce...
• [4] centralbank.ie/news/article/fti-finance-limited-(clone)--...
• [5] fca.org.uk/news/warnings/bwb-ireland-investment-managemen...
• [6] breakingnews.ie/business/central-bank-has-issued-almost-1...
• [7] linkedin.com/posts/compliance-institute_warning-notices-t...
• [8] irishtimes.com/business/financial-services/central-bank-i...

What Changed

• - The CBI has formally designated AGF International Advisors Company Limited (CLONE) and/or Iron-Cap / IRONCAP as an unauthorised investment firm / investment business firm and has published its...
• The specific websites www.iron-cap.com and https://www.iron-cap.io (including the French-language path https://www.iron-cap.io/fr/forgot-password/) have been identified as associated with this...
• The email addresses support@iron-cap.com and Samuel.breval@iron-cap.com have been flagged as being used by the unauthorised entity in connection with the Iron-Cap / IRONCAP investment offering.
• The CBI has reiterated that the clone is not authorised to provide investment services or investment business services in Ireland and has explicitly clarified that there is no connection whatsoever...
• The warning reinforces existing CBI expectations that Irish‑authorised firms and gatekeepers must monitor and respond to clone‑firm activity, including by reporting suspected unauthorised firms...

Suggested Considerations

• Review and update client‑onboarding procedures to include specific screening for the websites www.iron-cap.com and https://www.iron-cap.io and the email domains associated with Iron-Cap / IRONCAP, flagging and escalating any matches as suspected clone‑firm exposure.
• Update sanctions, fraud, and financial crime screening tools and internal watchlists to include the unauthorised firm identifiers associated with AGF International Advisors Company Limited (CLONE) and Iron-Cap / IRONCAP, ensuring alerts are generated for relevant customer or transaction hits.
• Strengthen fraud‑awareness communications to clients and staff by referencing the CBI’s financial scam materials, emphasising the risks of dealing with unauthorised firms and clone entities, and advising clients to verify firm authorisation before investing.
• Establish or update an internal escalation protocol for suspected clone‑firm activity, ensuring that all such cases are reported promptly to the CBI via the dedicated unauthorised firms reporting channels and, where applicable, to other relevant regulators.

Key Dates

References

• [1] centralbank.ie/news/article/press-release-warning-agf-(cl...
• [2] centralbank.ie/news/article/apel-investments-(clone)---ce...
• [3] cnmv.es/webservices/verdocumento/ver?e=25B0Uu3r5m6GcxD3cP...
• [4] fca.org.uk/news/warnings/agf-europe-advisors-clone
• [5] finanstilsynet.no/contentassets/94a5c72015a5407391c9f7eee...
• [6] centralbank.ie/news-media/warning-notices/56
• [7] cnmv.es/webservices/verdocumento/ver?e=sDwq3fSYKAJr8phF8P...
• [8] fi.ee/et/print/pdf/node/48614

What Changed

• - The CBI has formally designated Arbionis as an unauthorised investment firm and published its details (name, website, phone number) as a warning notice on its website.
• The CBI has clarified that Arbionis is not authorised to provide investment services in Ireland, meaning it cannot lawfully carry out regulated investment activities in or into Ireland.
• The name Arbionis has been published under section 53 of the Central Bank (Supervision and Enforcement) Act 2013, confirming this is part of the CBI’s supervisory and enforcement toolkit against...
• The warning reiterates that market participants and the public should use the CBI’s channels (telephone line and online reporting tool) to report suspected unauthorised firms or persons.
• The CBI re‑emphasises its consumer‑protection messaging, directing individuals and firms to its dedicated financial scams information page, thereby underlining expectations that firms proactively...

Suggested Considerations

• Screen all existing and prospective counterparties, introducers, and investment product providers against the CBI unauthorised firms list, and update internal watchlists to include Arbionis and its known identifiers (name, website, phone number).
• Prohibit onboarding Arbionis as a counterparty, intermediary, or service provider and ensure no marketing, introduction, or distribution arrangements exist or are entered into with this firm.
• Conduct an immediate review of client transaction flows and communications to identify any exposure to Arbionis, including referrals, introductions, payments, or client queries referencing Arbionis or its website.
• If any exposure to Arbionis is identified, escalate to compliance and legal functions, assess potential consumer detriment, and consider notifying the Central Bank of Ireland via the dedicated phone number or online reporting channel.
• Enhance client‑facing communications and website content to warn clients about unauthorised investment firms, referencing the CBI’s financial scams guidance and explaining how clients can verify authorisation status.

Key Dates

References

• [1] centralbank.ie/news/article/alliancebernstein-limited-(cl...
• [2] rte.ie/news/business/2021/1222/1268177-central-bank-warning/
• [3] centralbank.ie/news/article/beinfinity-clone----central-b...
• [4] centralbank.ie/news/article/warning-notice-lioniseassets-...
• [5] centralbank.ie/regulation/how-we-regulate/authorisation/u...
• [6] cnmv.es/webservices/verdocumento/ver?e=x8hCs+c9Bo88couiGD...
• [7] fi.ee/sites/default/files/2024-08/Guardian%20Invest%20-%2...
• [8] irishtimes.com/business/financial-services/central-bank-i...

What Changed

• - The CBI has formally designated “LGIM Managers (Europe) Limited (CLONE)” as an unauthorised investment firm / investment business firm and published its details on the CBI unauthorised firms list...
• The CBI has explicitly stated that the clone entity is not authorised to operate as an investment firm or investment business firm in Ireland, thereby clarifying that any investment services offered...
• The warning identifies specific contact details associated with the scam, including email addresses info@lgimeu.com (now inactive) and office@bunqpartner.com, a purported address at...
• The CBI has confirmed that the clone has copied the name and registration details of the legitimate CBI‑authorised firm LGIM Managers (Europe) Limited (C173733), while emphasising that there is no...
• By publishing the firm under section 53 of the Central Bank (Supervision and Enforcement) Act 2013, the CBI has activated its statutory regime for public warning notices on unauthorised firms,...

Suggested Considerations

• Update customer‑facing fraud warnings, website scam information pages, and client communications to include reference to the CBI warning on the LGIM clone and to explain how clients can verify whether a firm is authorised in Ireland.
• Enhance onboarding and periodic KYC / KYB procedures to include independent verification of counterparties’ authorisation status on the CBI register and cross‑check any claimed partnership with LGIM Managers (Europe) Limited, bunq Bank, or similar institutions.
• Implement or update internal guidance requiring staff to escalate immediately any client queries, introductions, or marketing materials referencing “LGIM Managers (Europe) Limited (CLONE)” or using the listed contact details to the compliance and financial crime teams.
• Conduct a targeted review of recent and ongoing distribution, referral, and introducer arrangements to identify any potential exposure to unauthorised clone entities or intermediaries misusing the LGIM brand or falsely claiming CBI authorisation.
• Train frontline staff, relationship managers, and call‑centre agents on the specific red flags associated with clones of authorised firms, including copied registration details, foreign addresses, and use of generic email domains, and on the process for verifying authorisation with the CBI.

Key Dates

References

• [1] centralbank.ie/news/article/warning-notice-central-bank-o...
• [2] centralbank.ie/news/article/j.p.-morgan-asset-management-...
• [3] cnmv.es/webservices/verdocumento/ver?e=25B0Uu3r5m6GcxD3cP...
• [4] fca.org.uk/consumers/warning-list-unauthorised-firms
• [5] am.landg.com/en-ie/institutional/scam-information/
• [6] finanstilsynet.no/contentassets/f9913c4f6ddc42d99873cc6d9...
• [7] fi.ee/et/print/pdf/node/51167
• [8] lexisnexis.com/en-gb/legal/news/ireland-cbi-issues-warnin...

What Changed

• - The CBI has formally identified “Inloovi Ireland Ltd. (Clone)” as an unauthorised insurance intermediary that is not authorised to provide insurance intermediary or insurance distribution services...
• The CBI has publicly associated specific digital identifiers with this fraudulent entity, including the website inloovi.com and email addresses insurance@inloovi.com, complaints@inloovi.com,...
• The CBI confirms that Inloovi Ireland Ltd. (Clone) has cloned details of a legitimate CBI‑authorised firm, A.R.B.
• The CBI clarifies that there is no connection whatsoever between the legitimate authorised entity and the clone firm, and the warning is intended to protect both consumers and the legitimate firm’s...
• The CBI reiterates that the name of the unauthorised firm is published under Section 53 of the Central Bank (Supervision and Enforcement) Act 2013, reinforcing its supervisory and enforcement stance...

Suggested Considerations

• Review and update internal sanctions/blacklist and fraud‑risk lists to include “Inloovi Ireland Ltd. (Clone)”, the domain inloovi.com, and the listed email addresses, ensuring screening across onboarding, claims, complaints, and payment processing.
• Conduct an immediate counterparty and referral review to confirm that no current or proposed distribution, outsourcing, or referral arrangements involve Inloovi Ireland Ltd. (Clone) or entities using the inloovi.com domain.
• Enhance KYC and intermediary due‑diligence procedures to include explicit checks against the CBI’s unauthorised firms list and Section 53 Warning Notices before entering into any new intermediary, coverholder, or introducer arrangement.
• Update staff training (particularly for sales, claims, complaints, and contact‑centre teams) on recognising clone‑firm indicators (e.g., similar names, use of look‑alike domains, unofficial email addresses) and on escalation pathways to compliance and fraud teams.
• Review and, where necessary, enhance website monitoring and brand‑abuse detection (including domain monitoring, phishing detection, and use of take‑down services) to identify and address fraudulent websites or email domains purporting to represent the firm.

Key Dates

References

• [1] centralbank.ie/news/article/dev-limited-(clone)---central...
• [2] centralbank.ie/news/article/pionew-ireland-(clone)---cent...
• [3] centralbank.ie/news/article/warning-notice-central-bank-o...
• [4] centralbank.ie/news/article/fti-finance-limited-(clone)--...
• [5] centralbank.ie/news/article/warning-notice-lioniseassets-...
• [6] centralbank.ie/news/article/central-bank-of-ireland-issue...
• [7] cnmv.es/webservices/verdocumento/ver?e=25B0Uu3r5m6GcxD3cP...
• [8] centralbank.ie/regulation/how-we-regulate/authorisation/u...

What Changed

• - The SFC and CSRC reinforced their commitment to joint enforcement cooperation specifically targeting cross‑boundary crimes and misconduct that affect both Hong Kong and Mainland Chinese markets.
• Both regulators agreed to deepen discussions and coordination around recent major cross‑boundary enforcement cases, indicating more systematic case‑level collaboration and mutual assistance.
• The authorities explicitly prioritised enhancing mechanisms for information exchange, implying more frequent, timely and possibly more granular sharing of regulatory, supervisory and investigative...
• The meeting confirms that cross‑boundary enforcement and investor protection remain strategic enforcement priorities for both the SFC and CSRC, which will likely influence case selection, resource...
• The emphasis on improving enforcement effectiveness and deterrence signals a likely increase in coordinated investigations, simultaneous actions, and potential parallel sanctions in both...

Suggested Considerations

• Review existing cross‑boundary business models, trading flows and client bases to identify areas where misconduct or control failures could trigger coordinated enforcement action by both the SFC and CSRC.
• Update enforcement‑facing compliance risk assessments to reflect heightened cross‑boundary enforcement cooperation, including the possibility of information sharing and parallel investigations by both regulators.
• Enhance incident escalation and regulatory engagement protocols to ensure that potential cross‑boundary issues (e.g. market manipulation, insider dealing, cross‑border fraud) are promptly identified and addressed with both Hong Kong and Mainland regulators where relevant.
• Review and, where necessary, strengthen surveillance and market‑abuse monitoring tools to capture cross‑market patterns (e.g. trading in Hong Kong linked to events or positions in Mainland markets).
• Ensure record‑keeping, trade data, client information and cross‑border communication logs are complete, accurate and retrievable, given the regulators’ focus on improving information exchange.

Key Dates

References

• [1] charltonslaw.com/sfc-and-csrc-hold-high-level-enforcement...
• [2] hk-lawyer.org/content/sfc-and-csrc-sign-memorandum-enhanc...
• [3] hkcgi.org.hk/news-event/news-detail/312288
• [4] icac.org.hk/en/p/press-archive/by-year/index_id_1598.html
• [5] investment-international.com/News/sfc-and-csrc-agree-deep...
• [6] csrc.gov.cn/csrc_en/c102030/c7125023/content.shtml
• [7] apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announce...
• [8] weex.com/news/detail/china-securities-regulatory-commissi...

What Changed

• - ESMA has started publishing annual market capitalisation figures and market capitalisation ratios for each EU Member State under its FASTER Directive mandate.
• The published figures are based on a harmonised methodology developed by ESMA in technical standards, using transaction data reported under MiFIR.
• Market capitalisation is calculated from shares admitted to trading on a regulated market or multilateral trading facility, with aggregation at the level of the issuer’s legal address in the relevant...
• The market capitalisation ratio is calculated as the Member State’s market capitalisation divided by the total market capitalisation of all Member States on the same date, expressed as a percentage.
• Member States whose market size exceeds 1.5% of total EU market capitalisation for four consecutive years are subject to specific withholding tax relief-related requirements.

Suggested Considerations

• Compliance teams should map whether any serviced Member State may approach or exceed the 1.5% threshold over a rolling four-year period and flag jurisdictions that could trigger special withholding tax relief consequences.
• Tax operations teams should align withholding tax relief workflows with the ESMA-published ratios so that jurisdictional eligibility assessments use the current official figures.
• Data and controls teams should document the calculation source, methodology, and reconciliation process for any internal use of ESMA market capitalisation data.
• Investment firms and intermediaries should review client-facing tax-relief processes to ensure they can respond to changes in Member State status under FASTER.
• Market-data and regulatory-reporting teams should prepare for annual updates by building a recurring review process around each ESMA publication cycle.

Key Dates

References

• [1] esma.europa.eu/sites/default/files/2025-10/ESMA12-1406959...
• [2] esma.europa.eu/sites/default/files/2025-06/ESMA12-1406959...
• [3] cnmv.es/DocPortal/DocFaseConsulta/CESR/CP_MarketCap_ENen.pdf
• [4] esma.europa.eu/press-news/consultations/consultation-meth...
• [5] czasopisma.uni.lodz.pl/fipf/article/view/27784
• [6] icmagroup.org/market-practice-and-regulatory-policy/repo-...
• [7] lexisnexis.com/en-gb/legal/news/esma-finalises-methodolog...
• [8] ec.europa.eu/transparency/documents-register/api/files/C(...

What Changed

• - The AMF has formalised and publicly communicated its enforcement findings and expectations on AML/CFT and AEI, turning past inspection outcomes into forward‑looking supervisory benchmarks for 2026...
• AML/CFT frameworks must move from generic and incomplete documentation to precise, activity‑specific procedures that clearly reflect the firm’s business model, products, distribution channels and...
• AML/CFT risk mapping must be personalised, complete, and demonstrably linked to the level and type of customer due diligence and ongoing monitoring applied; purely theoretical or non‑operational risk...
• Firms must implement robust oversight and documented supervision of delegates, distributors, service providers and other third parties involved in KYC or onboarding, rather than relying on unverified...
• Client, beneficial owner and source‑of‑funds information must be systematically collected, stored, updated and traceable, including clear identification and ongoing review of politically exposed...

Suggested Considerations

• Review and comprehensively update AML/CFT written policies and procedures to ensure they are complete, precise and clearly adapted to the firm’s specific activities, products, distribution channels and client profiles.
• Redesign AML/CFT risk mapping to be firm‑specific, cover all relevant money laundering and terrorist financing risks, and explicitly link identified risks to the intensity of customer due diligence and transaction monitoring measures applied.
• Implement a formalised framework for the oversight of delegates, distributors, service providers and other third parties performing KYC or onboarding tasks, including documented due diligence, contractual obligations, and periodic testing of their AML/CFT controls.
• Conduct a gap analysis of client and beneficial owner data collection, storage and updating processes to ensure full traceability of KYC information, including clear documentation of PEP identification and periodic review.
• Enhance due diligence procedures for investment and divestment operations involving fund assets, including documented risk assessments and escalation paths for unusual or higher‑risk transactions.

Key Dates

References

• [1] financialcrime.lu/2026/06/15/AMF-Enforcement-in-AML-CFT/
• [2] cssf.lu/wp-content/uploads/PSF-SP_2026_AML_conference.pdf
• [3] linkedin.com/posts/financialcrime-lu_amf-fra-amf-enforcem...
• [4] bradymartz.com/aml-cft-compliance-in-2026-staying-ahead-o...
• [5] amf-france.org/en/news-publications/news/autorite-des-mar...
• [6] freshfields.com/en/our-thinking/blogs/risk-and-compliance...
• [7] imf.org/en/topics/financial-integrity/amlcft
• [8] federalregister.gov/documents/2026/04/10/2026-07033/anti-...

What Changed

• - Japan has finalized a partial amendment to the list of designated countries/regions under Articles 17-2 and 17-3 of the Order for Enforcement of the Act on Prevention of Transfer of Criminal...
• The amendment expands the set of foreign jurisdictions for which Japanese firms must apply travel rule obligations when transferring cryptoassets and electronic payment instruments to foreign VASPs,...
• For transfers of cryptoassets and electronic payment instruments from Japanese VASPs to foreign VASPs, travel rule obligations apply only when the counterparty VASP is located in a jurisdiction...
• Transfers to foreign VASPs in non-designated jurisdictions remain outside the Japanese travel rule transmission obligation, reflecting JFSA’s concern about regulatory ineffectiveness where equivalent...
• The amendment confirms that the travel rule applies to both cryptoassets (virtual assets, VAs) and electronic payment instruments, including stablecoins (SCs) handled by Cryptoasset Exchange Service...

Suggested Considerations

• Review and obtain the official Attachment to identify the five newly added jurisdictions and verify their exact legal names and any specific conditions attached to their designation.
• Update internal jurisdiction lists and travel rule mapping to reflect all currently designated countries and regions under Articles 17-2 and 17-3, including the newly added five jurisdictions, ensuring that this mapping is embedded in transaction routing and screening engines.
• Revise travel rule implementation procedures so that originator and beneficiary information is consistently transmitted for all transfers of cryptoassets and electronic payment instruments from Japanese VASPs to foreign VASPs located in designated jurisdictions, including the new additions.
• Confirm that no de minimis threshold is applied in practice to covered transactions and that systems are configured to send travel rule data regardless of transaction size when the counterparty is in a designated jurisdiction.
• Update customer and counterparty onboarding documentation and contractual terms for foreign VASPs in newly designated jurisdictions to reflect their status as travel rule counterparties and any data-sharing, security, and retention requirements.

Key Dates

References

• [1] notabene.id/world/japan
• [2] sygna.io/blog/japan-travel-rule-starts-1-june-an-in-depth...
• [3] innreg.com/blog/crypto-travel-rule-guide
• [4] fsa.go.jp/en/newsletter/weekly2024/573_1.pdf
• [5] elliptic.co/blockchain-basics/what-is-the-travel-rule
• [6] sumsub.com/blog/what-is-the-fatf-travel-rule/
• [7] bitflyer.com/en-jp/faq/5-20

What Changed

• - A new governance and delivery model for UK retail payments infrastructure is being operationalised, with strategy set by the PVDC, design work led by the RPIB, and implementation by a new...
• The RPIB has launched a formal consultation on the design of the future retail payments infrastructure, seeking views on payment journeys, key design choices and priorities.
• The PVDC has published additional context to support stakeholders’ reading of the consultation, including expectations for the commercial model, consumer protection outcomes and financial crime...
• Responsibilities across the ecosystem are being reset, with clearer roles for public authorities (HM Treasury, Bank of England, FCA, PSR), Pay.UK, and industry participants in designing and...
• Next‑generation infrastructure is expected to support account‑to‑account payments at point of sale, enhanced cross‑border payments, and interoperability with new forms of digital money (including...

Suggested Considerations

• Assess and document your firm’s current and projected use of UK retail interbank payments (including Faster Payments, account‑to‑account, and cross‑border flows) to inform your response to the RPIB consultation.
• Prepare and submit a coordinated consultation response to the RPIB by 11 September 2026, covering your views on payment journeys, design choices, consumer protection needs and financial crime controls.
• Review your firm’s commercial and pricing models for interbank payments to understand how potential changes to the future infrastructure’s commercial model could affect revenue, costs and access.
• Map dependencies between your operational resilience framework and the existing UK retail payments infrastructure, and identify key risks and mitigants under a transition to the next‑generation infrastructure.
• Engage with industry bodies, Pay.UK and relevant trade associations to align positions on access, interoperability, fraud management, and technical standards for next‑generation retail payments.

Key Dates

References

• [1] gov.uk/government/publications/national-payments-vision/p...
• [2] finreg.aoshearman.com/uk-pvdc-strategy-for-future-retail-...
• [3] lewissilkin.com/en/insights/2026/03/05/payments-vision-de...
• [4] bankofengland.co.uk/news/2026/june/rpib-launches-consulta...
• [5] assets.publishing.service.gov.uk/media/690de7a247ad122f85...
• [6] fca.org.uk/news/statements/payments-vision-delivery-commi...
• [7] wiki.treasurers.org/wiki/Payments_Vision_Delivery_Committee
• [8] linkedin.com/posts/bank-of-england_the-retail-payments-in...

What Changed

• - MAS reaffirmed its willingness to hold senior management personally accountable where they fail to ensure their institution complies with MAS regulations, as illustrated by reprimands against...
• MAS demonstrated continued zero tolerance for trading-related offences under the Securities and Futures Act (SFA), supporting criminal prosecutions that resulted in imprisonment and substantial fines...
• MAS confirmed that Major Payment Institution (MPI) licences can and will be revoked where inspections reveal significant weaknesses in risk management, conflict-of-interest policies, and...
• MAS signalled continued priority on AML/CFT supervision and enforcement by imposing a $300,000 composition penalty on a licensed trust company (Padang Trust Singapore Pte.
• MAS underscored its ongoing focus on insider trading and market abuse by imposing a civil penalty on an individual for insider trading in shares of a Singapore-listed (now delisted) company.

Suggested Considerations

• Review and, where necessary, enhance senior management and board-level oversight frameworks to ensure that responsibilities for MAS regulatory compliance are clearly allocated, documented, and evidenced (e.g. through committee charters, management information, and challenge records).
• Conduct a targeted compliance review at fund managers and other CMS licence holders to assess adherence to MAS regulations, focusing on areas previously cited in MAS enforcement actions (e.g. internal controls, client asset safeguards, and recordkeeping).
• For Major Payment Institutions and other payment providers, perform a comprehensive gap analysis of risk management frameworks, conflict-of-interest policies, and compliance with MAS Guidelines on Outsourcing, including due diligence, ongoing monitoring, and intra-group/related-party arrangements.
• Implement or strengthen formal governance around the accuracy and completeness of all information submitted to MAS (licence applications, regulatory returns, inspection responses), including sign-off controls, documentation standards, and verification procedures.
• For licensed trust companies and other AML/CFT-obliged entities, review and update AML/CFT policies, customer due diligence (CDD) and enhanced due diligence (EDD) procedures, ongoing monitoring, and suspicious transaction reporting processes in line with MAS Notices and Guidelines.

Key Dates

References

• [1] mas.gov.sg/news/media-releases/2026/key-enforcement-actio...
• [2] linkedin.com/pulse/mas-imposes-over-20m-penalties-aml-mar...
• [3] mas.gov.sg/regulation/enforcement/enforcement-actions
• [4] ncontracts.com/nsight-blog/enforcement-actions-roundup-ap...
• [5] sec.gov/newsroom/press-releases/2026-34
• [6] opensanctions.org/datasets/sg_mas_enforcement_actions/
• [7] reedsmith.com/articles/investigations-and-enforcement-tre...
• [8] fincen.gov/news/enforcement-actions

What Changed

• - CSSF has published its 2025 supervisory disclosure covering supervisory measures and administrative penalties taken during the year.
• The publication serves as a public register-style disclosure of enforcement outcomes, increasing transparency around CSSF supervision and sanctioning activity.
• A related 2025 CSSF administrative sanction shows that AML/CFT non-compliance can result in a reprimand under the amended Luxembourg AML/CFT Law.
• The 28 July 2025 sanction confirms that CSSF can act where firms fail to maintain adequate professional AML/CFT obligations and related internal controls.

Suggested Considerations

• Review the firm’s AML/CFT control framework against the Luxembourg AML/CFT Law provisions that can trigger CSSF reprimands or sanctions, including governance, monitoring, and escalation controls.
• Verify that suspicious activity detection, investigation, and escalation procedures are documented, implemented, and tested for effectiveness.
• Reassess whether internal controls are sufficient to demonstrate timely compliance with professional AML/CFT obligations under CSSF supervision.
• Update remediation tracking to ensure supervisory findings are closed out promptly and supported by evidence of corrective action.
• Brief senior management on the reputational impact of public supervisory disclosures and ensure that recurring weaknesses are escalated to the board.

Key Dates

References

• [1] cssf.lu/wp-content/uploads/S_49_B_X_280725_en.pdf
• [2] elvingerhoss.lu/insights/publications/international-sanct...
• [3] cssf.lu/wp-content/uploads/FAQ_International_financial_sa...
• [4] cssf.lu/en/supervisory-disclosure/
• [5] cssf.lu/en/regulatory-framework/page/6/
• [6] linkedin.com/pulse/enforcement-actions-against-private-fu...
• [7] cliffordchance.com/content/dam/cliffordchance/PDFDocument...
• [8] cssf.lu/wp-content/uploads/2025-AML-CFT-conference-dedica...

What Changed

• - The CBI has added Loan Empower Solution (website: lesolution.eu) to its public list of unauthorised firms and explicitly categorised it as an unauthorised retail credit firm operating without the...
• The CBI has publicly stated that Loan Empower Solution appears to be operating an advance fee fraud model, where upfront payments are requested for credit services that are never provided.
• The CBI has confirmed that the firm is using a purported Irish business address (The Merrion Buildings, 18–20 Merrion Street, Dublin 2, D02 XH98), a non-Irish telephone number, and a specified...
• The firm’s name has been published under section 53 of the Central Bank (Supervision and Enforcement) Act 2013, reaffirming the CBI’s use of its statutory power to publicly identify entities...
• The CBI has directed the public to its unauthorised firms search and financial scams information pages, implicitly reinforcing expectations that firms promote use of these tools in their consumer...

Suggested Considerations

• Review and update internal unauthorised-firm and scam monitoring procedures to ensure Loan Empower Solution and its identifiers (name, website, address, email, telephone number) are captured in watchlists, fraud rules, and staff guidance.
• Screen recent and ongoing customer transactions and communications for any references to Loan Empower Solution or similar lending scams requesting upfront “loan fees”, and escalate any matches to fraud and compliance teams.
• Update customer-facing communications and website scam warnings to highlight the risk of advance fee fraud in retail credit, referencing the need to check the CBI registers and unauthorised-firms list before engaging with lenders.
• Ensure call centre, branch, and digital support staff are trained to identify and respond to customers approached by unauthorised lenders, including how to advise customers to verify authorisation status on the CBI website and to report suspected scams.
• Incorporate checks against the CBI unauthorised firms search into onboarding, due diligence, and third-party risk management processes for any lending-related partnerships, introducers, or lead generators.

Key Dates

References

• [1] centralbank.ie/news/article/loan-empower-solutions--centr...
• [2] centralbank.ie/news/article/central-bank-of-ireland-issue...
• [3] irishtimes.com/business/financial-services/regulator-issu...
• [4] fi.ee/sites/default/files/2023-05/Central%20Bank%20of%20I...
• [5] centralbank.ie/regulation/how-we-regulate/authorisation/u...
• [6] fi.ee/sites/default/files/2023-05/Central%20Bank%20of%20I...
• [7] garda.ie/en/about-us/our-departments/office-of-corporate-...

What Changed

• *(Based on the CSSF notice plus the 2025 FATF revisions to Recommendation 16 and existing travel‑rule standards; details may be further refined by the new guidance now under consultation.)*
• FATF is issuing implementation guidance for the updated Recommendation 16, which already increased obligations regarding payment transparency, including more granular beneficiary data and expanded...
• Cross‑border payments and value transfers above 1,000 USD/EUR are expected to include additional mandatory beneficiary information, such as beneficiary name, account or unique reference, and at least...
• Beneficiary institutions are given enhanced responsibilities to use travel‑rule information (not just receive it) for transaction monitoring, including detecting misdirected payments and indicators...
• The revised travel rule continues to apply to both traditional wire transfers and value transfers involving virtual assets, reinforcing that Virtual Asset Service Providers (VASPs) must collect,...

Suggested Considerations

• Map and document all existing and planned cross‑border payment and value‑transfer flows (including virtual asset transfers) to identify where FATF Recommendation 16 and travel‑rule obligations currently apply or will apply by 2030.
• Review the June 2025 FATF modifications to Recommendation 16 and the current consultation materials, and perform a gap analysis against your existing AML/CTF, KYC and payments data standards, including thresholds, data fields, and monitoring use‑cases.
• Establish an internal project for travel‑rule implementation and enhancement that spans AML, operations, technology, legal and data‑protection teams, with explicit ownership and governance.
• Strengthen beneficiary‑side transaction‑monitoring rules to use incoming travel‑rule data for sanctions, fraud and AML detection, including controls to identify misdirected or unusual payments based on name, location, and other attributes.
• Review and, where necessary, update customer due diligence and KYC procedures to ensure the availability and verification of data fields that will be required to travel with transactions (for example, address, town and country, identification numbers, date of birth).

Key Dates

References

• [1] mayerbrown.com/en/insights/publications/2025/08/fatf-revi...
• [2] moodys.com/web/en/us/kyc/resources/insights/fatf-recommen...
• [3] innreg.com/blog/fatf-travel-rule-crypto-fintech-complianc...
• [4] vaspnet.com/articles/how-the-eus-travel-rule-goes-above-a...
• [5] sumsub.com/blog/what-is-the-fatf-travel-rule/

What Changed

• - The CSSF formally identifies Luxembourg “obliged entities” under AML/CFT law that are potentially eligible for direct AMLA supervision, clarifying which categories of firms fall into the EU‑level...
• The circular operationalises, at CSSF level, the EU allocation mechanism for direct supervision, building on Regulation (EU) 2024/… establishing AMLA and the forthcoming directly applicable AML...
• The CSSF establishes a process for providing information to AMLA on Luxembourg obliged entities (e.g. size, cross‑border activities, risk profile) to support AMLA’s periodic selection and review of...
• The circular clarifies that CSSF‑supervised entities identified as “eligible” remain under CSSF supervision unless and until AMLA formally designates them for direct supervision, at which point AMLA...
• The circular anticipates enhanced data and reporting requirements for entities assessed as eligible for AMLA direct supervision, including more granular information on cross‑border business,...

Suggested Considerations

• Determine whether your firm is likely to fall within the “eligible for AMLA direct supervision” perimeter by assessing your cross‑border footprint, ML/TF risk profile, group structure, and relative size against AMLA’s high‑risk and cross‑border criteria.
• Review and update the firm‑wide AML/CFT risk assessment to ensure it is robust, data‑driven, and aligned with an EU‑level supervisory perspective, including explicit consideration of cross‑border risks, complex group structures, and high‑risk products.
• Strengthen AML/CFT governance and oversight, including Board and senior management reporting, to demonstrate clear ownership of ML/TF risk, documented risk appetite, and effective challenge consistent with what AMLA expects from directly supervised entities.
• Review and, where necessary, enhance customer due diligence, transaction monitoring, screening and suspicious activity reporting frameworks to withstand more intrusive and harmonised EU‑level scrutiny.
• Map and document cross‑border business lines and passporting activities (branches, agents, tied intermediaries, distributors) to ensure you can provide complete and up‑to‑date information to the CSSF and AMLA on request.

Key Dates

References

• [1] pwc.lu/en/newsletter/2026/cssf-circular-26-906-in-focus.html
• [2] linkedin.com/posts/khadija-bartali-ghazzale-74925793_cssf...
• [3] klgates.com/Luxembourgs-CSSF-Circular-26/906-on-Central-A...
• [4] loyensloeff.com/insights/news--events/news/circular-cssf-...
• [5] cssf.lu/en/Document/circular-cssf-26-904/
• [6] luther-lawfirm.com/fileadmin/user_upload/NF_CSSF_Circular...
• [7] cssf.lu/en/Document/circular-cssf-26-906/
• [8] cssf.lu/en/Document/circular-cssf-26-912/

What Changed

• - CSSF republished the annex to Circular CSSF 22/822 in a Version of 19 June 2026, meaning firms should treat this as the current Luxembourg reference point for FATF jurisdiction screening and...
• The annex distinguishes between high-risk jurisdictions subject to enhanced due diligence and, where appropriate, counter-measures, and jurisdictions under increased monitoring that require...
• The publication incorporates the FATF’s current statements on jurisdictions with strategic AML/CFT/CPF deficiencies, which is the basis for operational country-risk controls used by...
• The related Circular CSSF 22/822 remains the framework document that instructs professionals to use FATF statements when assessing jurisdictional ML/TF/PF risk.

Suggested Considerations

• Review your AML/CFT country-risk methodology and update it to reflect the 19 June 2026 FATF/CSSF jurisdiction list.
• Re-screen customers, beneficial owners, counterparties, and transactions against the updated high-risk and monitored jurisdiction lists.
• Apply enhanced due diligence for relationships and transactions involving high-risk jurisdictions, and escalate where counter-measures may be required.
• Reassess risk ratings for customers linked to jurisdictions under increased monitoring and document the rationale for any continued onboarding, retention, or exit decisions.
• Update automated screening rules, transaction-monitoring scenarios, and onboarding checklists so they use the current CSSF annex version.

Key Dates

References

• [1] cssf.lu/wp-content/uploads/cssf22_822_eng.pdf
• [2] cssf.lu/wp-content/uploads/cssf22_822_annexe_eng_271025.pdf
• [3] cssf.lu/wp-content/uploads/cssf22_822_annexe_eng_260623.pdf
• [4] cssf.lu/en/Document/annex-of-circular-cssf-22-822-11/
• [5] linkedin.com/posts/bastien-collette-17686229_annex-of-cir...
• [6] regulplus.com/post/0/en/cssf-circular-22-822
• [7] cssf.lu/en/Document/annex-of-circular-cssf-22-822-10/
• [8] cssf.lu/en/Document/annex-of-circular-cssf-22-822-9/

What Changed

• - The CBI has formally designated Lambestone Holding Limited (CLONE) as an unauthorised investment firm, investment business firm and crypto‑asset service provider for Ireland, and has published its...
• The warning confirms that Lambestone Holding Limited (CLONE) is not authorised to operate as an investment firm or to provide crypto‑asset services in Ireland, and therefore may not lawfully provide...
• The CBI explicitly identifies Lambestone Holding Limited (CLONE) as a “clone firm” that has copied the name, address and CRO number of a legitimate company in the Companies Registration Office (CRO)...
• The CBI clarifies that there is no connection whatsoever between the legitimate CRO‑registered company and the scam entity, thereby protecting the reputation of the genuine firm and reducing...
• The warning includes a non‑exhaustive list of websites, email domains and telephone numbers used by the clone (multiple .com domains, support and individual email accounts, and international phone...

Suggested Considerations

• Update internal sanctions, fraud, and high‑risk entity screening lists immediately to include Lambestone Holding Limited (CLONE), its known websites, email addresses and telephone numbers, and ensure these are used in client onboarding, periodic KYC reviews and transaction monitoring.
• Instruct client‑facing and dealing staff not to refer clients to, or accept instructions from, Lambestone Holding Limited (CLONE) or any individual using the listed domains, emails or phone numbers, and document this in internal guidance.
• Review and enhance client‑due‑diligence procedures to include explicit checks for clone‑firm indicators, including mismatches between a firm’s claimed regulatory status and the CBI online registers, as well as verification against CRO records.
• Implement a formal process to monitor and log Central Bank of Ireland warning notices (and similar notices from ESMA, other EU national competent authorities, FCA, etc.) and to propagate relevant alerts across first‑ and second‑line control functions.
• Conduct targeted staff awareness and training sessions for front‑office, call‑centre, and complaints‑handling teams on clone‑firm typologies, with Lambestone Holding Limited (CLONE) used as a current example of CRO‑identity cloning.

Key Dates

References

• [1] centralbank.ie/news/article/lambestone-holding-limited-(c...
• [2] centralbank.ie/news/article/alliancebernstein-limited-(cl...
• [3] finanstilsynet.no/contentassets/1f99db27d4004b4198e3a44d1...
• [4] centralbank.ie/news/article/larl-f.s.---larl-financial-se...
• [5] linkedin.com/posts/compliance-institute_warning-notices-t...
• [6] centralbank.ie/news/article/oristan-ireland-designated-ac...
• [7] fi.ee/sites/default/files/2024-11/Central%20Bank%20of%20I...
• [8] cnmv.es/webservices/verdocumento/ver?e=PZ874GHUZKcaucoAoa...

What Changed

• - The CBI has formally identified MakoTrade as an unauthorised investment firm / unauthorised investment business firm in Ireland.
• The warning confirms that MakoTrade is not authorised to provide investment services in Ireland, regardless of any claimed affiliation with the BlauStein Investitionen Gruppe.
• The CBI has published the firm’s website address and email address used as part of its warning notice, signaling an active consumer-protection alert.
• The publication falls under section 53 of the Central Bank (Supervision and Enforcement) Act 2013, which is the statutory basis for naming the unauthorised firm.
• The CBI directs the public to its financial scams guidance and provides a reporting route for information about unauthorised firms.

Suggested Considerations

• Screen all new and existing client introductions, counterparties, and external inquiries against the CBI warning list and treat MakoTrade as unauthorised unless independently proven otherwise.
• Block or escalate any payments, transfers, or onboarding requests involving MakoTrade, its website, its email domain, or any claimed BlauStein Investitionen Gruppe affiliation.
• Update fraud and scam detection playbooks to include the CBI’s warning notice as a trigger for enhanced due diligence and referral to financial crime teams.
• Notify relationship managers, client-facing staff, and call-centre teams that MakoTrade must not be represented as authorised in Ireland.
• Review client complaints, inbound leads, and suspicious payment patterns for any contact with the listed website or email address and preserve evidence for reporting.

Key Dates

References

• [1] centralbank.ie/news/article/makotrade---central-bank-of-i...
• [2] centralbank.ie/news/article/alliancebernstein-limited-(cl...
• [3] financemagnates.com/forex/regulation/central-bank-ireland...
• [4] fi.ee/sites/default/files/2024-08/IrelandRateFinder.com%2...
• [5] finanstilsynet.no/contentassets/dc527d5779a44031b7a784d2d...
• [6] finma.ch/en/finma-public/warnungen/warning-list/
• [7] fca.org.uk/consumers/warning-list-unauthorised-firms
• [8] fi.ee/sites/default/files/2026-05/damac-trade-clone-centr...

What Changed

• - The CBI has formally published AllianceBernstein Limited (CLONE) under section 53 of the Central Bank (Supervision and Enforcement) Act 2013 as an unauthorised firm.
• The warning confirms that the clone is not authorised to provide investment firm or investment business firm services in Ireland.
• The CBI identifies the use of cloned identity details—specifically the legitimate firm’s name and address—as a deceptive tactic intended to add legitimacy to the scam.
• The notice provides the specific scam email addresses used by the unauthorised entity, which should be treated as fraud indicators in screening and client-education controls.
• The CBI reiterates that consumers and counterparties can report suspicious firms directly to the regulator and that the publication sits within its broader anti-scam warning framework.

Suggested Considerations

• Verify that any entity claiming to be AllianceBernstein Limited is matched against the CBI authorisation register before any onboarding, trading, mandate acceptance, or payment activity.
• Block or escalate any contact using the email addresses clientservices@abprivatemanagement.com and info@abprivatemanagement.com as potential fraud indicators.
• Update fraud and onboarding controls to detect clone-firm impersonation, including mismatches in firm name, address, domain, and regulator reference details.
• Notify client-facing teams and operations staff that the legitimate authorised firm has no connection with the clone entity and that enquiries should be independently verified.
• Refresh customer communications and website warnings to remind clients to confirm authorisation status before sharing funds or instructions.

Key Dates

References

• [1] centralbank.ie/news/article/alliancebernstein-limited-(cl...
• [2] centralbank.ie/news/article/larl-f.s.---larl-financial-se...
• [3] breakingnews.ie/business/central-bank-has-issued-almost-1...
• [4] fca.org.uk/news/warnings/alliance-bernstein-clone-fca-aut...
• [5] centralbank.ie/news/article/oristan-ireland-designated-ac...
• [6] dfsa.dk/supervision/warnings-from-other-supervisory-autho...
• [7] cryptolegal.uk/list-of-reported-scam-companies-part-1/
• [8] iosco.org/i-scan/?SUBSECTION=main&VALIDATIONDATESTART=&NC...

What Changed

• - The CBI has formally designated “LARL F.S / LARL Financial Services (CLONE)” as an unauthorised investment firm / unauthorised investment business firm and has added it to its public list of...
• The CBI has confirmed that LARL F.S / LARL Financial Services (CLONE) is not authorised to provide investment services in Ireland and is falsely claiming to be regulated by the CBI under reference...
• The CBI has identified specific scam touchpoints used by the clone, including the website larlfs.com and email domains larlfs-eu.com and larlfs.com, enabling firms to update internal watchlists and...
• The CBI has explicitly clarified that there is no connection whatsoever between the clone entity and the legitimate authorised firm LARL Financial Services Limited (C176004), thereby protecting the...
• The warning reiterates the CBI’s use of its Section 53 powers to publish the name of firms that either provide financial services without appropriate authorisation or hold themselves out as regulated...

Suggested Considerations

• Update internal sanctions, fraud, and high‑risk entity lists to include “LARL F.S / LARL Financial Services (CLONE)” and the domains larlfs.com and larlfs-eu.com, and block these from use in onboarding, payments, and trading systems.
• Conduct an immediate review of current and recent client files, leads, and referrals to identify any exposure to or interaction with the clone entity, and where found, assess whether suspicious transaction reports or fraud notifications are required under local AML and financial crime rules.
• Issue client communications or website notices, especially if your firm’s name is similar to LARL Financial Services, warning clients about clone scams, clarifying official contact points, and instructing clients never to rely on unsolicited contact or unverified email domains.
• Update fraud‑awareness and conduct‑risk training materials for staff to cover CBI warnings on clone firms, the specific red flags (misuse of legitimate authorisation numbers, mismatched contact details, unverified websites), and the internal process to verify a firm’s authorisation status.
• Review existing distribution and introducer agreements to ensure there is an explicit prohibition on counterparties using the firm’s name, logo, or authorisation details in any way that could facilitate cloning or misrepresentation of regulatory status.

Key Dates

References

• [1] centralbank.ie/news/article/larl-f.s.---larl-financial-se...
• [2] centralbank.ie/news/article/apel-investments-(clone)---ce...
• [3] centralbank.ie/news/article/alliancebernstein-limited-(cl...
• [4] centralbank.ie/regulation/how-we-regulate/authorisation/u...
• [5] centralbank.ie/news/article/smh-markets-(clone)---central...
• [6] centralbank.ie/news/article/bw-financial-services-(clone)...
• [7] centralbank.ie/news/article/fti-finance-limited-(clone)--...
• [8] centralbank.ie/news/article/makotrade---central-bank-of-i...

What Changed

• - The CBI has formally identified “Oristan Ireland Designated Activity Company (CLONE)” as an unauthorised investment firm / investment business firm / alternative investment fund manager and...
• The CBI confirms that the clone firm is not authorised in Ireland to provide investment services, investment business services, or AIFM activities, despite using the name, address and CBI...
• The warning enumerates specific fraud infrastructure used by the clone: four domains (including “oristanirelanddac.com”, “oristan-ire.com” and “oristanportal.com”), multiple email addresses...
• The CBI explicitly clarifies there is no connection whatsoever between the legitimate authorised Oristan Ireland DAC and the clone entity or its websites.
• The firm’s name is published under section 53 of the Central Bank (Supervision and Enforcement) Act 2013, reinforcing the statutory basis for public warning notices against unauthorised firms.

Suggested Considerations

• Update internal unauthorised / fraud firm watchlists and screening tools to include “Oristan Ireland Designated Activity Company (CLONE)” and all associated domains, email addresses and phone numbers listed in the CBI notice.
• Implement or enhance name‑matching and clone‑detection controls in onboarding processes to distinguish between the legitimate Oristan Ireland DAC (as per the CBI register) and any entity using the clone websites or contacts.
• Review and adjust KYC/CDD procedures to ensure that unusual or mismatched email domains, websites, or phone numbers (particularly those not appearing on the CBI register or official corporate filings) trigger enhanced due diligence and formal second‑line review.
• Conduct a targeted communication and training for relationship managers, sales staff, call‑centre agents and client‑facing teams on the Oristan clone case and recent CBI clone‑firm warnings, with practical red‑flag indicators and escalation channels.
• Review current fraud‑risk and AML / financial crime frameworks to confirm that clone‑firm risks (including identity theft of authorised entities) are explicitly covered in risk assessments, controls, and monitoring scenarios.

Key Dates

References

• [1] centralbank.ie/news/article/naperte-designated-activity-c...
• [2] fi.ee/sites/default/files/2026-01/Standard%20Life%20Irela...
• [3] centralbank.ie/news/article/oristan-ireland-designated-ac...
• [4] linkedin.com/posts/compliance-institute_warning-notices-t...
• [5] fi.ee/sites/default/files/2026-04/Naperte%20Designated%20...
• [6] finanstilsynet.no/contentassets/e4bd5fa31aa346e799c5a9dde...
• [7] cnmv.es/webservices/verdocumento/ver?e=4OjGxKvv%2B9DO10aJ...
• [8] cnmv.es/webservices/verdocumento/ver?e=ex4nmnXnYNN7l3U8XF...